A dynamic updating method, device and equipment of a network honeypot and a storage medium

Abstract

The embodiment of the application discloses a kind of dynamic updating method, device, equipment and storage medium of network honeypot, comprising: initializing network honeypot;In the case where attack operation event is detected, the interactive data corresponding to attack operation event is analyzed to obtain analysis result;In the case where analysis result meets preset update condition, determine the first environment configuration parameter matched with the attack behavior characteristic in analysis result, and the second environment configuration parameter matched with interactive data, based on the first environment configuration parameter and the second environment configuration parameter, the network honeypot obtained after initialization is dynamically updated.Above, the ability of camouflage and anti-identification of honeypot can be effectively improved, the effective life cycle of honeypot is prolonged, the continuous trapping and behavior perception of attacker are realized, and the active security defense effect of network is significantly enhanced.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for dynamically updating a network honeypot. Background Technology

[0002] Honeypots are a typical proactive defense technology in the field of cybersecurity. By deploying simulated fake network resources and system services, they construct a trapping environment to actively attract network attackers to launch probing and intrusion activities. During the attacker's interaction, they capture and record complete attack behaviors and operational trajectories in real time. Based on the collected data, attack characteristic analysis and threat assessment are conducted, providing data support for network intrusion detection, attack tracing, and security situation awareness. Honeypots are now widely used in the field of network security protection.

[0003] Existing honeypot technologies are mainly divided into low-interaction honeypots and high-interaction honeypots. Low-interaction honeypots can only simulate limited network services, have a low degree of simulation, a fixed form of performance, are easily detected by attackers, and have poor deception effects. High-interaction honeypots, although using real system environments, have high deployment and operation costs, and their environment parameters, camouflage features, bait resources, and interaction strategies are all pre-configured statically, resulting in short honeypot lifecycles and poor deception stability. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for dynamically updating network honeypots, solving the problems of low simulation level, fixed appearance, short lifespan, and poor deception stability in existing honeypot technologies. It can dynamically analyze attack behavior characteristics based on real-time collected attack interaction data, adaptively adjust the honeypot simulation environment according to the actual attack situation, effectively improve the honeypot's deception and anti-identification capabilities, extend the honeypot's effective lifespan, achieve continuous capture and behavioral awareness of attackers, and significantly enhance the effectiveness of proactive network security defense.

[0005] In a first aspect, embodiments of this application provide a method for dynamically updating a network honeypot, comprising: Initialize the network honeypot; Upon detecting an attack operation event, the attack behavior characteristics of the interaction data corresponding to the attack operation event are analyzed to obtain the analysis results. If the analysis results meet the preset update conditions, a first environment configuration parameter matching the attack behavior characteristics in the analysis results and a second environment configuration parameter matching the interaction data are determined, and the network honeypot obtained after initialization is dynamically updated based on the first environment configuration parameter and the second environment configuration parameter.

[0006] Optionally, the step of performing attack behavior feature analysis on the interaction data corresponding to the attack operation event to obtain the analysis result includes: A multi-dimensional feature vector is generated based on the operation sequence, instruction characteristics, access trajectory, and behavior frequency in the interaction data corresponding to the attack operation event. The multidimensional feature vector is matched with a preset attack behavior feature vector, and the attack behavior features are determined based on the matching results. The attack behavior features include attack type, attack intent, and attack stage, and the analysis results are obtained.

[0007] Optionally, the step of matching the multidimensional feature vector with a preset attack behavior feature vector and determining the attack behavior features based on the matching result includes: Calculate the feature similarity value between the multidimensional feature vector and the preset attack behavior feature vector. If the feature similarity value exceeds the preset similarity threshold, determine the attack type corresponding to the feature similarity value and the historical behavior data corresponding to the attack type. Based on historical timestamps, the operation data of each attacker in the historical behavior data are linked together to generate multiple operation chains; The multiple operation links are categorized and statistically analyzed. The operation link that appears most frequently in the statistical results is identified as the target operation link, and the attack intent corresponding to the target operation link is determined. The operation complexity is calculated based on the multidimensional feature vector to obtain a complexity value, and the attack stage corresponding to the complexity value is determined.

[0008] Optionally, the first environmental configuration parameters include simulation response mode, bait delivery strategy and environmental evolution mode, and the second environmental configuration parameters include environmental parameter adjustment range and trapping intensity level; Accordingly, determining the first environment configuration parameter that matches the attack behavior characteristics in the analysis results, and the second environment configuration parameter that matches the interaction data, includes: According to preset matching rules, the simulation response mode corresponding to the attack type, the decoy deployment strategy corresponding to the attack intent, and the environmental evolution mode corresponding to the attack stage are determined respectively. The attack density is determined based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data. The environmental parameter adjustment range and trapping intensity level corresponding to the attack density are determined according to the preset matching rules.

[0009] Optionally, determining the attack density based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data includes: The frequency of unit operations in the interactive data is segmented and statistically analyzed according to a preset time window, and the operation surge state within a unit time is determined based on the segmented statistical results. The intervals between adjacent operations in the interactive data are compared with a preset range of operation time intervals, and the attack sequence continuity level is determined based on the processing results. The duration of continuous operation in the interaction data is compared with a preset stability threshold, and the stability parameter is determined based on the comparison result. The attack density level is determined based on the operational surge state, the attack timing continuity level, and the stability parameter.

[0010] Optionally, determining the attack density level based on the operational surge state, the attack timing continuity level, and the stability parameter includes: The operation burst state, the attack timing continuity level, and the stability parameter are standardized and mapped to obtain a first quantization score, a second quantization score, and a third quantization score. The attack density score is obtained by weighting and summing the first quantized score, the second quantized score, and the third quantized score according to preset weights. The attack density score is compared with the preset density grading threshold one by one, and the attack density level is determined based on the comparison results.

[0011] Optionally, after obtaining the analysis results by performing attack behavior feature analysis on the interaction data, the method further includes: If the analysis results do not meet the preset update conditions, the interactive data and the analysis results are processed in a structured manner to obtain structured intelligence information.

[0012] In a second aspect, embodiments of this application provide a dynamic update device for a network honeypot, comprising: The initialization module is used to initialize the network honeypot. The attack behavior feature analysis module is used to perform attack behavior feature analysis on the interaction data corresponding to the attack operation event when an attack operation event is detected, and obtain the analysis results. The environment configuration parameter determination module is used to determine, when the analysis results meet preset update conditions, a first environment configuration parameter that matches the attack behavior characteristics in the analysis results and a second environment configuration parameter that matches the interactive data. The dynamic update module is used to dynamically update the network honeypot obtained after initialization based on the first environment configuration parameters and the second environment configuration parameters.

[0013] In a third aspect, embodiments of this application provide an electronic device, the device comprising: one or more processors; and a storage device configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the dynamic update method for the network honeypot described in the first aspect.

[0014] In a fourth aspect, embodiments of this application provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the dynamic update method for a network honeypot as described in the first aspect.

[0015] This application embodiment initializes a network honeypot; upon detecting an attack event, it analyzes the interaction data corresponding to the attack event to obtain analysis results; if the analysis results meet preset update conditions, it determines a first environment configuration parameter matching the attack behavior characteristics in the analysis results and a second environment configuration parameter matching the interaction data; and it dynamically updates the initialized network honeypot based on the first and second environment configuration parameters. This approach enables the matching of appropriate environment configuration parameters to the network honeypot and dynamic updates based on real-time attack behavior analysis results, effectively solving the problems of traditional honeypots' static configuration, low simulation accuracy, and susceptibility to attackers. It significantly improves the honeypot's camouflage, deception, and anti-fingerprinting capabilities, extends its effective lifespan, and simultaneously achieves accurate perception and adaptive defense against attack behavior, enhancing the real-time performance and effectiveness of proactive network security protection. Attached Figure Description

[0016] Figure 1 This is a flowchart of a dynamic update method for a network honeypot provided in an embodiment of this application; Figure 2 This is a flowchart of an attack behavior feature analysis method provided in an embodiment of this application; Figure 3 This is a flowchart of a method for determining attack behavior characteristics provided in an embodiment of this application; Figure 4 This is a schematic diagram of an operation chain used in an embodiment of this application; Figure 5 This is a flowchart of a method for determining attack density provided in an embodiment of this application; Figure 6 This is a flowchart of a method for determining attack density provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of a dynamic update device for a network honeypot provided in an embodiment of this application; Figure 8This is a schematic diagram of the structure of a dynamic update device for a network honeypot provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, specific embodiments of this application will be described in further detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely for explaining this application and not for limiting it. It should also be noted that, for ease of description, only the parts relevant to this application are shown in the drawings, not all of them. Before discussing exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe operations (or steps) as sequential processes, many of these operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but may also have additional steps not included in the drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0018] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0019] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0020] The data transmission method, apparatus, device, and medium provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0021] The dynamic update method for network honeypots provided in this application embodiment is used in scenarios such as proactive network security defense for enterprise intranets, data centers, cloud platforms, and critical information infrastructure. It is understood that the execution subject of each step can be a computer device, which refers to any electronic device with data computing, processing, and storage capabilities, such as a server. This application embodiment does not limit this.

[0022] Figure 1 This is a flowchart of a dynamic update method for a network honeypot provided in an embodiment of this application, such as... Figure 1 As shown, it includes: S101. Initialize the network honeypot.

[0023] A honeypot can be a proactive security defense technology that deploys simulated network resources / system services to deliberately expose a decoy environment to attract attackers and capture attack behavior, analyze attack methods, delay the attack process, and protect the real business system. Initialization refers to the entire process of creating the environment, configuring parameters, deploying decoys, and starting the service before the honeypot is officially activated, putting the honeypot into a ready state that is accessible, responsive to attacks, and capable of collecting data.

[0024] In one embodiment, the process of initializing a network honeypot can be as follows: Based on preset simulation service types and defense targets, automatically create corresponding virtual network environments and simulation service instances; complete basic masquerading configurations such as host fingerprinting, port services, system versions, and decoy files; start attack monitoring and data collection interfaces; load initial interaction response rules and trapping strategies; and adjust the honeypot to a ready state where it can be accessed externally, respond normally, and capture attack behavior in real time, providing a stable and reliable basic operating platform for subsequent attack detection, behavior analysis, and dynamic environment updates. For example, the system deploys a honeypot disguised as a "finance department file server," containing decoy files such as fake financial statements and draft contracts generated by LLM.

[0025] S102. When an attack operation event is detected, the attack behavior characteristics of the interaction data corresponding to the attack operation event are analyzed to obtain the analysis results.

[0026] Among these, attack operation events refer to malicious operations such as probing, intrusion, control, and damage initiated by attackers against network honeypots. Interaction data refers to data such as operation sequences, command content, access trajectories, message information, and behavior logs generated during the response process between the attacker and the honeypot. Attack behavior feature analysis refers to the process of extracting, modeling, and matching the above interaction data to identify attack types, attack intentions, attack stages, and behavioral patterns. Analysis results refer to the judgment information output after feature analysis, including attack type, attack intention, attack stage, behavioral frequency, and danger level.

[0027] In one embodiment, the process of detecting attack operation events can be as follows: while continuously monitoring network access and honeypot interaction behavior, attack operation events are identified and captured in real time through preset abnormal behavior rules, traffic characteristics and operation risk thresholds. Once malicious access, illegal commands, brute-force attempts, abnormal scanning and other attack behaviors are detected, all interaction data generated between the attacker and the honeypot are collected in full.

[0028] In one embodiment, the process of analyzing the attack behavior characteristics of the interaction data corresponding to the attack operation event to obtain the analysis results can be as follows: the original interaction data generated between the attacker and the honeypot is collected completely; the interaction data is first sorted by timestamp, deduplicated, and structured; a time-series linked list and state machine transition record of the operation behavior are constructed to reconstruct the behavior trajectory and obtain the operation trajectory; then, based on the pre-trained attack behavior classification model, the trajectory feature vector is classified by intent and probabilistic reasoning to determine the operation intent; finally, the risk score is calculated according to the harm weight, duration, and access permissions of the attack behavior; the risk attribute corresponding to the risk score is determined according to the label mapping relationship; and finally, the analysis results containing the operation trajectory, operation intent, and risk attribute are generated.

[0029] S103. If the analysis results meet the preset update conditions, determine the first environment configuration parameters that match the attack behavior characteristics in the analysis results and the second environment configuration parameters that match the interactive data, and dynamically update the network honeypot obtained after initialization based on the first environment configuration parameters and the second environment configuration parameters.

[0030] The preset update conditions can refer to pre-configured feature thresholds, risk levels, or sets of behavioral rules used to determine whether honeypot environment adjustments need to be triggered. Attack behavior characteristics can refer to key attributes extracted from interaction data that characterize attack types and intentions, such as operation sequences, instruction features, access trajectories, and behavioral frequencies. The first environment configuration parameters can refer to environment configuration items adapted to the attack behavior characteristics to adjust the honeypot simulation response and decoy strategy. The second environment configuration parameters can refer to parameters that match the intensity, frequency, and duration of interaction data, used to control the honeypot adjustment range and decoy intensity. Dynamic updates refer to the process of real-time adaptive adjustments to the simulation environment, service characteristics, and decoy resources based on configuration parameters without interrupting honeypot operation.

[0031] Optionally, the first environmental configuration parameters include the simulation response mode, bait deployment strategy, and environmental evolution mode, while the second environmental configuration parameters include the adjustment range of environmental parameters and the trapping intensity level.

[0032] Among these, the simulation response mode refers to the operational response rules and simulation methods of the honeypot system in simulating real business devices to respond to data, provide command feedback, and engage in interactive feedback. The decoy deployment strategy refers to the timing, type, and distribution rules for the honeypot to proactively deploy decoy content such as fake resources, vulnerability entry points, and sensitive files in response to different attack behaviors. The environment evolution mode refers to the operational mechanism by which the honeypot autonomously adjusts the simulation scenario, service version, and vulnerability characteristics according to the progress of the attack behavior, achieving dynamic iterative evolution of the environment. The environmental parameter adjustment range refers to the quantitative range of changes made by the honeypot to parameters such as simulation service configuration, scenario characteristics, and response latency during dynamic updates. The trapping strength level refers to the hierarchical classification of the honeypot's ability to attract attackers to stay, induce deep probing, and maintain continuous interaction; the higher the level, the stronger the trapping effect.

[0033] In one embodiment, the process of determining whether the analysis result meets the preset update conditions can be as follows: The structured data output by the attack behavior feature analysis, such as attack type, behavior risk value, operation frequency, and attack stage, is compared and logically verified item by item with conditions such as update threshold, feature matching degree, risk level threshold, and attack behavior triggering rules pre-fixed in the configuration file. A rule engine performs Boolean judgments and weighted scoring calculations on the multi-dimensional features. When the score reaches or exceeds the trigger threshold and the feature matching result matches the preset update rule, the analysis result is determined to meet the preset update conditions; otherwise, it is determined not to meet them. Specifically, the item-by-item numerical comparison and logical verification process can be as follows: First, the structured data such as attack type, risk level, behavior frequency, and attack stage are converted into computable values ​​and enumerated states. Then, according to preset logic, single-condition threshold matching, multi-condition AND / OR / NOT combination judgment, feature similarity matching verification, and attack continuity and intensity verification are executed sequentially. A true / false Boolean value is output for each verification result. Finally, a judgment conclusion on whether the update conditions are met is generated through weighted scoring and a final logical gate decision.

[0034] In one embodiment, the process of determining the first environment configuration parameter that matches the attack behavior characteristics in the analysis results and the second environment configuration parameter that matches the interactive data can be as follows: Based on the attack behavior characteristics in the analysis results, perform index query and similarity matching in a preset feature-parameter mapping table to determine the first environment configuration parameter that is suitable for the current attack type, attack intent and attack stage. At the same time, based on the quantitative characteristics such as operation frequency, time interval and duration in the interactive data, calculate the attack density and behavior intensity, and query the matching second environment configuration parameter according to the behavior intensity-parameter mapping relationship, such as the instruction to speed up the simulated encryption response speed, or the instruction to release a secondary decoy program disguised as a "decryption tool" in the final stage of encryption.

[0035] In one embodiment, the process of dynamically updating the network honeypot obtained after initialization based on the first environment configuration parameters and the second environment configuration parameters can be as follows: First, the first environment configuration parameters and the second environment configuration parameters are fused and their legality is verified, conflict items are eliminated, and a final effective configuration set is generated. Then, without interrupting the honeypot monitoring service, the simulation characteristics, response rules, decoy resources, and interaction strategies of the initialized network honeypot are adjusted and refreshed in real time through memory overwriting, configuration hot reloading, and incremental modification of virtual environment state, thereby completing the imperceptible dynamic update of the honeypot environment.

[0036] This application embodiment initializes a network honeypot; upon detecting an attack event, it analyzes the interaction data corresponding to the attack event to obtain analysis results; if the analysis results meet preset update conditions, it determines a first environment configuration parameter matching the attack behavior characteristics in the analysis results and a second environment configuration parameter matching the interaction data; and it dynamically updates the initialized network honeypot based on the first and second environment configuration parameters. This approach enables the matching of appropriate environment configuration parameters to the network honeypot and dynamic updates based on real-time attack behavior analysis results, effectively solving the problems of traditional honeypots' static configuration, low simulation accuracy, and susceptibility to attackers. It significantly improves the honeypot's camouflage, deception, and anti-fingerprinting capabilities, extends its effective lifespan, and simultaneously achieves accurate perception and adaptive defense against attack behavior, enhancing the real-time performance and effectiveness of proactive network security protection.

[0037] Figure 2 This is a flowchart of an attack behavior feature analysis method provided in an embodiment of this application, such as... Figure 2 As shown, it includes: S1021. Generate a multi-dimensional feature vector based on the operation sequence, instruction characteristics, access trajectory, and behavior frequency in the interaction data corresponding to the attack operation event.

[0038] Here, an operation sequence refers to an ordered set of actions performed by an attacker in chronological order. Command characteristics refer to characteristic information such as attack keywords, parameter formats, invocation methods, and protocol types input by the attacker, which can be used to identify attack behavior. Access trajectories refer to the attacker's access paths, resource access order, and privilege escalation processes within the honeypot environment. Behavior frequency refers to quantitative statistical characteristics such as the number of times the attacker performs operations per unit time, command sending rate, and number of repeated accesses. A multidimensional feature vector refers to a high-dimensional data structure formed by numerically and vectorizing multiple features such as operation sequences, command characteristics, access trajectories, and behavior frequencies, which can be used for model calculation and feature matching.

[0039] In one embodiment, the process of generating a multidimensional feature vector based on the operation sequence, instruction features, access trajectory, and behavior frequency in the interaction data corresponding to the attack operation event can be as follows: First, perform temporal alignment, field extraction, and data cleaning on the interaction data; transform the operation sequence into ordered encoding; extract keywords and protocol identifiers for instruction features; construct path topology vectors for access trajectories; and keep the behavior frequency unchanged. Then, normalize the above four types of features respectively, and finally concatenate and fuse them into a multidimensional feature vector according to a fixed dimension. For example, the attacker's "port scanning → directory traversal → uploading Trojan" operation sequence is encoded as [1,3,5], the instruction feature extraction "POST, upload, eval" identifiers are encoded as [0,1,1], the access trajectory is encoded as [80,443,8080], and the behavior frequency is encoded as [5] at 5 times per second. Finally, they are concatenated to form a unified multidimensional feature vector [1,3,5,0,1,1,80,443,8080,5].

[0040] S1022. Match the multidimensional feature vector with the preset attack behavior feature vector, determine the attack behavior features based on the matching results, and the attack behavior features include attack type, attack intent and attack stage, and obtain the analysis results.

[0041] The preset attack behavior feature vector refers to a standardized numerical vector of known attack behaviors that has been pre-constructed and stored, serving as a baseline feature template for matching and comparison. Matching refers to the process of using computer algorithms to calculate the similarity or distance between a multi-dimensional feature vector and the preset attack behavior feature vector to determine the type of behavior. Matching results can refer to the similarity value, confidence level, or the most similar attack behavior number output after quantitative matching, etc. Attack type refers to the specific category of the attack, such as port scanning, brute-force attacks, SQL injection, and ransomware encryption. Attack intent refers to the attacker's purpose in performing the operation, such as information theft, privilege escalation, lateral movement, and data corruption. Attack stage refers to the link in the attack chain, such as probing scans, intrusion attempts, persistent control, and data leakage.

[0042] In one embodiment, the process of matching a multidimensional feature vector with a preset attack behavior feature vector can be as follows: first, load a pre-stored library of various attack behavior benchmark feature vectors; then, calculate the feature similarity between the current multidimensional feature vector and each benchmark feature vector using cosine similarity or Euclidean distance algorithms to obtain the corresponding similarity score; and finally, compare each calculated similarity score with a preset similarity threshold to select candidate vectors with similarity scores higher than the preset similarity threshold.

[0043] In one embodiment, the process of determining the attack behavior characteristics based on the matching results can be as follows: determine the preset benchmark vector for optimal matching based on the similarity score output by vector matching, retrieve the association mapping table between vector identifiers and attack attributes, and retrieve the attack type, attack intent, and attack stage label information bound to the benchmark vector.

[0044] Figure 3 This is a flowchart of a method for determining attack behavior characteristics provided in an embodiment of this application, such as... Figure 3 As shown, it includes: S10221. Calculate the feature similarity value between the multidimensional feature vector and the preset attack behavior feature vector. If the feature similarity value exceeds the preset similarity threshold, determine the attack type corresponding to the feature similarity value and the historical behavior data corresponding to the attack type.

[0045] The feature similarity value refers to the quantified numerical value of the similarity between the current multidimensional feature vector and the preset benchmark vector, calculated using vector distance or similarity algorithms. The preset similarity threshold refers to a pre-set critical value standard used to determine whether the vector matching is valid and whether it qualifies for attack attribution. Historical behavioral data refers to historical sample data such as past interaction records, operation logs, feature parameters, and behavioral trajectories of the same type of attack associated with the identified attack type.

[0046] In one embodiment, the process of calculating the feature similarity value between the multidimensional feature vector and the preset attack behavior feature vector can be as follows: according to the cosine similarity or Euclidean distance calculation function, traverse all the reference vectors in the feature library in turn, perform numerical calculation and cumulative solution of the corresponding components in each dimension, and obtain the feature similarity value in the interval of 0 to 1, which quantitatively represents the degree of similarity between the current multidimensional feature vector and each preset attack behavior feature vector.

[0047] In one embodiment, the calculated feature similarity value is compared with a preset similarity threshold. Based on the comparison result, it is determined whether the feature similarity value exceeds the preset similarity threshold. If it does, the attack type corresponding to the feature similarity value and the historical behavior data corresponding to the attack type are determined.

[0048] In one embodiment, the process of determining the attack type corresponding to the feature similarity value and the historical behavior data corresponding to the attack type can be as follows: Sort the calculated feature similarity values ​​from high to low, filter out target similarity values ​​exceeding a preset similarity threshold, retrieve the corresponding standard attack type identifier based on the target similarity value's association mapping table, and then, using the determined attack type as the retrieval key, traverse the historical access logs, operation command sequences, traffic interaction records, and behavior statistics samples under the same category tag in the background database to retrieve complete and associated historical behavior data. For example, if the current vector has the highest similarity to the port scan class benchmark vector and exceeds the threshold, the attack type can be determined as port scanning through mapping relationship matching. Then, using port scanning as the keyword, retrieve historical behavior data such as access port sequences, scan frequency records, and command interaction messages of the same type of port scan from the database.

[0049] S10222. Based on historical timestamps, the operation data of each attacker in the historical behavior data are linked together to generate multiple operation links.

[0050] Historical timestamps refer to the precise timestamps for each historical behavior data record, accurate to the second or millisecond, used to characterize the chronological order of each operation. An attacker refers to a network entity that initiates network probing, malicious access, or attack attempts, interacting with the honeypot environment. Operation data refers to the detailed record information contained in a single historical behavior data record, including specific operation instructions, access behaviors, resource requests, and actions. Chaining refers to the process of sorting, associating, and integrating fragmented single operation records according to their chronological order, based on the attacker's identity and historical timestamps. An operation chain refers to the complete and continuous chain of behavioral operation processes formed by sequentially piecing together the discrete operation data of the same attacker, used to reconstruct the complete attack behavior path.

[0051] In one embodiment, the process of generating multiple operation links by concatenating the operation data of each attacker in historical behavior data based on historical timestamps can be as follows: First, the attacker's identity, historical timestamp, and corresponding single operation data are parsed and extracted from the historical behavior data. All discrete operation data are clustered based on the attacker's identity as the grouping criterion. All operation data of the same attacker are grouped into the same data group. Then, the operation data in each group are sorted in ascending order according to the historical timestamp. The fragmented single operation records are sequentially associated, spliced, time-aligned, and concatenated with the behavior nodes according to the chronological order. Finally, multiple standardized operation links that are independent and time-coherent are generated for different attackers. Figure 4This is a schematic diagram of an operation chain used in an implementation of this application. For example, if the operation records in the historical behavior data are as follows: Attacker A performs a port scan at 09:00:01, Attacker B performs directory traversal at 09:00:05, Attacker A uploads a file at 09:00:03, Attacker B executes the `eval` command at 09:00:08, Attacker A modifies the file extension at 09:00:06, and Attacker B sends a POST request at 09:00:02, then... Figure 4 As shown, the operation chain of attacker A is generated based on this record: port scanning → file upload → file extension modification. The operation chain of attacker B is: sending a POST request → directory traversal → executing the eval command.

[0052] S10223. Classify and statistically analyze multiple operation links, identify the operation link that appears most frequently in the statistical results as the target operation link, and determine the attack intent corresponding to the target operation link.

[0053] Categorization statistics refer to the process of clustering multiple operational links with similar structures and consistent behavioral processes, and calculating the frequency and distribution of each group of operational links. The statistical results can refer to a summary dataset of link types, corresponding frequencies, and behavioral characteristics obtained after categorization and grouping. Frequency of occurrence refers to the number of times an operational link with the same behavioral process appears repeatedly in all samples. The target operational link can refer to the standard operational link with the highest frequency of occurrence in all operational link groups.

[0054] In one embodiment, the process of classifying and statistically analyzing multiple operation links can be as follows: First, analyze the order of behavioral nodes and operation type characteristics of each operation link. Perform feature matching and clustering on operation links with similar structures and consistent behavioral processes. Classify operation links with highly overlapping node sequences and behavioral patterns into the same category. Then, count the number of operation links within each group and record the corresponding frequency. For example, summarize the attack operation links of "port scanning-directory probing-weak password attempt" and "port scanning-vulnerability detection-malicious file upload". Group the links of the same type of "port scanning-directory probing-weak password attempt" into one group, and group the links of "port scanning-vulnerability detection-malicious file upload" into another group. Count the occurrence frequency of each of the two groups of links.

[0055] In one embodiment, the process of identifying the most frequent operation link in the statistical results as the target operation link and determining the corresponding attack intent can be as follows: Iterate through each group of operation links and their corresponding frequency values ​​after classification and statistics, compare the frequency values ​​of each group one by one, filter out the group of operation links with the highest frequency values, determine the standard link sequence corresponding to this group as the target operation link, and then retrieve the pre-stored operation link and attack intent mapping table to match the behavioral purpose tag corresponding to the target operation link to determine the attack intent. For example, after classification and statistics, the link "port scan → directory traversal → weak password attempt" appears 6 times, and the link "port scan → vulnerability detection → Trojan upload" appears 3 times. The system automatically filters out the link that appears 6 times as the target operation link, and then matches the attack intent corresponding to the target operation link through a preset mapping relationship as detection and investigation and illegal login intrusion.

[0056] S10224. Calculate the operation complexity based on multi-dimensional feature vectors, obtain the complexity value, and determine the attack stage corresponding to the complexity value.

[0057] Operational complexity calculation refers to the process of quantifying the multidimensional feature vectors based on their dimensionality distribution, numerical differences, number of behavioral nodes, and the correlation between instruction combinations using a pre-defined complexity algorithm. The complexity value refers to the quantified value calculated by the algorithm, used to objectively measure the cumbersomeness of the attack steps, the complexity level of the instruction combinations, and the completeness of the behavioral chain.

[0058] In one embodiment, the process of calculating the complexity value based on the multidimensional feature vector can be as follows: First, decompose the multidimensional feature vector into the components of operation sequence, instruction features, access trajectory, and behavior frequency. Then, count the number of behavior nodes, the richness of instruction types, the number of access path levels, and the density of behavior frequency. Finally, perform a weighted summation operation based on the preset weight coefficients corresponding to each dimension to obtain the operation complexity value that can quantify the complexity of attack behavior steps and the depth of behavior levels.

[0059] In one embodiment, the complexity levels of different numerical ranges are predefined, and each range is bound with a unique corresponding attack stage identifier. Accordingly, the process of determining the attack stage corresponding to the complexity value can be as follows: the complexity levels of different numerical ranges are predefined, and each range is bound with a unique corresponding attack stage identifier. After obtaining the operation complexity value, the value is matched with the preset range thresholds one by one to locate the numerical range to which the complexity value belongs. Then, the pre-associated and bound stage attribute tag of the range is retrieved to accurately match and determine the current attack behavior's attack stage, such as probing, intrusion breakthrough, deep penetration, or persistent control.

[0060] Figure 5This is a flowchart of an environmental configuration parameter determination method provided in an embodiment of this application, such as... Figure 5 As shown, it includes: S1031. Determine the simulation response mode corresponding to the attack type, the decoy deployment strategy corresponding to the attack intent, and the environmental evolution mode corresponding to the attack stage according to the preset matching rules.

[0061] Among them, the preset matching rules can refer to the pre-defined mapping logic and judgment criteria. The unit operation frequency can refer to the number of times an attacker initiates requests, executes instructions, or accesses resources within a unit of time in the interaction data, and is used to characterize the density of the behavior.

[0062] In one embodiment, the process of determining the simulation response mode corresponding to the attack type, the decoy deployment strategy corresponding to the attack intent, and the environmental evolution mode corresponding to the attack stage according to the preset matching rules can be as follows: First, extract the attack type, attack intent, and attack stage from the analysis results to form complete attack behavior characteristics. Then, retrieve the mapping association table contained in the preset matching rules in the background and perform association matching one by one according to the rules. Match the identified attack types such as port scanning and vulnerability injection with the corresponding honeypot simulation response mode, match the attack intents such as information theft and privilege escalation with the corresponding decoy deployment strategy, and match the attack stages such as probing and penetration with the corresponding environmental evolution mode. Finally, combine the simulation response mode, attack intent, and environmental evolution mode determined above to obtain the first environment configuration parameters adapted to the current attack behavior characteristics.

[0063] S1032. Determine the attack density based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data.

[0064] The interval between adjacent operations refers to the time difference between two consecutive operations by the attacker, reflecting the pace of the attack. The duration of continuous operation refers to the total length of time from the attacker's initial access to the honeypot to the termination of interaction. Attack density is a level indicator of the compactness and activity of the attacker's behavior, quantified by the frequency of unit operations, the interval between adjacent operations, and the duration of continuous operation.

[0065] In one embodiment, the process of determining the attack density based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data can be as follows: First, extract three types of behavioral indicators from the interaction data: unit operation frequency, adjacent operation interval, and continuous operation duration. For example, if the attacker initiates 18 access requests within one minute, the average interval between adjacent operations is 2 seconds, and the overall continuous interaction duration is 15 minutes, then normalize and quantify each indicator, and then substitute it into a preset weight formula for weighted fusion calculation to obtain a comprehensive quantitative score. Match the comprehensive quantitative score with a predefined attack density level range to determine the attack density level to which the comprehensive quantitative score belongs. The attack density level can include three different levels: high, medium, and low.

[0066] S1033. Determine the adjustment range of environmental parameters and the trapping intensity level corresponding to the attack density according to the preset matching rules.

[0067] In one embodiment, the process of determining the environmental parameter adjustment range and trapping intensity level corresponding to the attack density according to preset matching rules can be as follows: First, a preset matching rule mapping table is established between each attack density level and the environmental parameter adjustment range and trapping intensity level. Then, the calculated attack density level corresponding to the corresponding level is determined. Next, the matching rule table is traversed based on this level to retrieve the pre-bound environmental parameter adjustment range and trapping intensity level for that level. For example, when the current attack density is determined to be high, a larger range of environmental parameter adjustments and a higher-order trapping intensity level are automatically matched according to the preset matching rules. If the attack density is low, a smaller parameter adjustment range and a basic trapping intensity level are matched.

[0068] In this application, the simulation response mode corresponding to the attack type, the decoy deployment strategy corresponding to the attack intent, and the environmental evolution mode corresponding to the attack stage are determined according to preset matching rules. The attack density is determined based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data. The adjustment range of environmental parameters and the decoy intensity level corresponding to the attack density are determined according to preset matching rules. The honeypot's operation configuration can be adaptively adjusted based on the characteristics of real attack behavior and interaction activity, avoiding the problem of a fixed and singular honeypot strategy. This improves the honeypot's simulation realism, decoy inducement ability, and adaptability to dynamic environmental evolution for different attack behaviors. It can accurately cater to the attacker's behavioral habits to extend the interaction duration and capture more attack samples, while also controlling the environmental adjustment intensity and decoy level as needed, ensuring the stability and effectiveness of honeypot operation and significantly improving network attack perception and behavior tracing capabilities.

[0069] Figure 6 This is a flowchart of a method for determining attack density provided in an embodiment of this application, such as... Figure 6As shown, it includes: S10321. Perform segmented statistics on the unit operation frequency in the interactive data according to the preset time window, and determine the operation surge state within a unit time based on the segmented statistics results.

[0070] The preset time window refers to a pre-defined fixed-duration statistical interval, which can serve as a time granularity standard for segmenting and extracting interactive data for statistical analysis. Segmented statistics refer to the process of dividing continuous interactive time-series data into multiple independent time periods, using the preset time window as the unit, and statistically analyzing the operation frequency for each time period. The segmented statistical results refer to the set of corresponding operation frequency values ​​obtained from the statistical analysis within each time window. A sudden increase in operation frequency refers to an abnormal behavior state characterized by a sudden and significant increase in the unit operation frequency within a certain time window compared to the preceding and following time periods or the baseline normal frequency.

[0071] In one embodiment, a fixed-duration preset time window is first set as the statistical granularity. The continuous time-series interaction data is divided into multiple independent time periods according to the time window. The attacker's behavior operations within each time window are counted one by one to obtain the frequency value of each time period. Then, the difference in frequency between adjacent time periods is calculated. When the absolute value of the difference in operation frequency within a certain time window is much greater than the absolute value of the difference between other adjacent time periods, it can be determined that a sudden increase in operation has occurred within that time window. For example, a preset time window of 1 minute is set, and the operation frequencies for each time period are statistically analyzed to be 5, 6, 22, 7, and 4 times respectively. The preset absolute difference is 5. The absolute difference in operation frequency between the first and second minutes is 1, the absolute difference in operation frequency between the second and third minutes is 16, the absolute difference in operation frequency between the third and fourth minutes is 15, and the absolute difference in operation frequency between the fourth and fifth minutes is 3. It can be seen that the absolute difference in operation frequency between the second and third minutes and the absolute difference in operation frequency between the third and fourth minutes both exceed the preset absolute difference. At this time, it can be determined that there is a sudden increase in operation in the third minute.

[0072] S10322. Compare the interval between adjacent operations in the interactive data with the preset time interval range, and determine the attack sequence continuity level based on the processing result.

[0073] The preset operation time interval range can refer to multiple pre-defined standard time interval thresholds, which can be used as a reference standard to judge the density of adjacent operation intervals. The processing result can refer to the interval assignment result and feature determination result obtained after adjacent operation intervals are assigned to the corresponding preset time intervals. The attack sequence continuity level can refer to the level divided according to the density pattern of adjacent operation intervals, which is used to characterize the degree to which the attacker's operation behavior is continuous, compact, or discontinuous in time.

[0074] In one embodiment, the process of comparing the interval between adjacent operations in the interactive data with the preset operation time interval range can be as follows: first, extract the time nodes of each pair of consecutive operations from the interactive data one by one, calculate the values ​​of all adjacent operation intervals, and then compare and match each adjacent operation interval with the multiple preset operation time interval ranges predefined by the system one by one.

[0075] In one embodiment, the process of determining the attack timing continuity level based on the processing results can be as follows: statistically analyzing the proportion of intervals falling into each interval and the overall distribution characteristics, obtaining classification results according to preset level determination rules, and then dividing the attack timing continuity levels into different levels. For example, the system presets 1-3 seconds as a high continuity interval, 4-8 seconds as a medium continuity interval, and more than 9 seconds as a low continuity interval. If multiple sets of adjacent operation intervals of the attacker are extracted, with intervals of 2 seconds, 3 seconds, 5 seconds, and 6 seconds respectively, and more than 50% of the adjacent operation intervals fall into the medium-high continuity interval, then the attacker's timing behavior can be determined to be compact and coherent, corresponding to a high timing continuity level.

[0076] S10323. Compare the duration of continuous operation in the interaction data with the preset stability threshold, and determine the stability parameter based on the comparison result.

[0077] The preset stability threshold can refer to several pre-defined time thresholds, serving as a benchmark for judging the duration and stability of attacker actions. The comparison result can refer to the relationship between the duration of continuous operation and the preset threshold, as well as the judgment conclusion for the corresponding interval. The stability parameter can refer to a quantitative parameter or level label generated based on the duration comparison result, used to characterize the stability of the attacker's continuous interactive behavior.

[0078] In one embodiment, the process of comparing the duration of continuous operation in the interaction data with a preset stability threshold can be as follows: First, the start time of the attacker's first operation and the end time of the last interaction are captured from the interaction data. The complete duration of continuous operation is calculated by the time difference. Then, the duration value is compared and matched with multiple preset stability threshold intervals set by the system one by one to determine the threshold interval in which the duration of continuous operation is located.

[0079] In one embodiment, corresponding stability parameter levels and quantization values ​​are pre-configured for different stability threshold ranges. Accordingly, the process of determining the stability parameter based on the comparison results can be as follows: after comparing the continuous operation duration with the preset stability threshold and determining the range, the quantization value or level identifier corresponding to that range is matched according to a preset mapping rule, thereby generating a stability parameter characterizing the persistence and stability of the attacker's interactive behavior. For example, the system may preset "less than 5 minutes" to correspond to a low stability parameter, "5 to 15 minutes" to correspond to a medium stability parameter, and "more than 15 minutes" to correspond to a high stability parameter. When the attacker's continuous operation duration is 18 minutes, after comparison, it falls into the "more than 15 minutes" threshold range, and the system will match and output a high-level stability parameter.

[0080] S10324. Determine the attack density level based on the operation surge state, attack timing continuity level, and stability parameters.

[0081] In one embodiment, the process of determining the attack density level based on the operation surge state, attack timing continuity level, and stability parameters can be as follows: the system first quantifies and assigns values ​​to the operation surge state, attack timing continuity level, and stability parameters respectively, and then performs a weighted fusion calculation on the three quantified indicators according to the preset weighting rules to obtain a comprehensive score. The predefined level range standard determines the attack density level to which the comprehensive score belongs.

[0082] In this embodiment, by segmenting and statistically analyzing the unit operation frequency of interactive data within a preset time window, abnormal behavior characteristics of short-term operation surges can be accurately captured. Furthermore, by comparing the interval between adjacent operations with a preset time interval range, the attack sequence continuity level is divided. At the same time, the duration of continuous operations is compared with a preset stability threshold to obtain stability parameters. Multi-indicator comprehensive judgment is achieved from three dimensions: operation burstiness, sequence continuity, and behavior persistence. This avoids the one-sidedness of single-dimensional evaluation and can comprehensively, meticulously, and quantitatively depict the attacker's behavioral activity patterns and interaction characteristics. This makes the final determined attack density level more objective, accurate, and consistent with the real attack situation, effectively improving the perception and identification capabilities of network attack behavior and the simulation and trapping adaptation effect.

[0083] Optionally, the attack density level is determined based on the operational surge state, the attack timing continuity level, and stability parameters, including: standardizing and mapping the operational surge state, the attack timing continuity level, and stability parameters to obtain a first quantization score, a second quantization score, and a third quantization score; weighting and summing the first quantization score, the second quantization score, and the third quantization score according to preset weights to obtain an attack density score; comparing the attack density score with preset density grading thresholds one by one, and determining the attack density level based on the comparison results.

[0084] Standardization mapping refers to the process of converting qualitative levels or status indicators such as operational surge states, attack sequence continuity levels, and stability parameters into quantified scores with unified dimensions and a uniform numerical range, according to a unified conversion rule. The first quantified score refers to the normalized value obtained after standardizing the operational surge state, used to quantify the degree of operational anomalies. The second quantified score refers to the normalized value obtained after standardizing the attack sequence continuity level, used to quantify the coherence and compactness of the attack operation sequence. The third quantified score refers to the normalized value obtained after standardizing the stability parameter, used to quantify the stability of continuous attack behavior. Preset weights refer to the weight coefficients pre-set by the system for each of the three quantified scores, reflecting the contribution ratio of each indicator to attack density. Weighted summation calculation refers to the operation method of multiplying each quantified score by its corresponding preset weight and then summing the results. The attack density score refers to the comprehensive quantified score obtained after weighted summation, which centrally reflects the overall intensity and activity level of attack behavior. Preset density grading thresholds can refer to multiple pre-defined critical score ranges, serving as criteria for classifying different attack density levels. Attack density levels can refer to the grading results based on attack density scores compared to the grading thresholds, used to hierarchically characterize the overall density of attack behavior.

[0085] In one embodiment, the process of standardizing and mapping operational surge states, attack timing continuity levels, and stability parameters to obtain first, second, and third quantified scores can be as follows: The system pre-establishes a unified standardized mapping rule table, assigning fixed quantified scores and unified numerical ranges for each level and state of operational surge states, attack timing continuity levels, and stability parameters. Then, the collected actual operational surge states, attack timing continuity levels, and stability parameters are sequentially matched against the mapping rule table, converting them one by one into corresponding standard quantified scores, generating a first quantified score representing the suddenness of the operation, a second quantified score representing the continuity of the timing, and a third quantified score representing the sustained stability of the behavior. For example, the preset mapping for no operational surge is 20 points, for a slight surge is 60 points, and for a severe surge is 100 points; low, medium, and high attack timing continuity are mapped to 30, 60, and 90 points respectively; and low, medium, and high stability parameter levels are mapped to 25, 55, and 85 points respectively.

[0086] In one embodiment, the process of calculating the attack density score by weighting and summing the first, second, and third quantitative scores according to preset weights can be as follows: The system pre-configures fixed preset weight coefficients for the first, second, and third quantitative scores. First, each quantitative score is multiplied by its corresponding weight coefficient to obtain a single weighted value. Then, the three weighted values ​​are summed to finally calculate the attack density score, which represents the overall activity level. For example, setting the weight for a sudden increase in activity to 0.4, the weight for attack sequence continuity level to 0.35, and the weight for stability parameters to 0.25, if the first quantitative score is 100, the second quantitative score is 90, and the third quantitative score is 85, the single weighted values ​​are calculated as 40, 31.5, and 21.25 respectively. After summing, the overall attack density score is 92.75.

[0087] In one embodiment, the process of comparing the attack density score with preset density grading thresholds one by one to determine the attack density level can be as follows: The system predefines multiple preset density grading thresholds and correspondingly divides different attack density levels. The calculated attack density score is compared with each grading threshold in turn, and interval matching is performed to determine the threshold interval in which the score falls. Then, the corresponding level identifier is matched according to the interval assignment result to determine the final attack density level. For example, preset three grading thresholds are 0-40 points for low density, 41-70 points for medium density, and 71-100 points for high density. If the obtained attack density score is 92.75 points, and after comparison, it falls into the 71-100 point interval, it can be directly determined as a high density level.

[0088] In this embodiment, a first quantified score, a second quantified score, and a third quantified score are obtained by standardizing and mapping the operation surge state, attack timing continuity level, and stability parameters. The first quantified score, the second quantified score, and the third quantified score are then weighted and summed according to preset weights to obtain an attack density score. The attack density score is compared with a preset density grading threshold one by one, and the attack density level is determined based on the comparison results. This avoids the arbitrariness of subjective human judgment and the one-sidedness of single indicator judgment, making the attack density level results objective and accurate. This provides a standardized and reliable quantitative basis for subsequent adaptive adjustment of honeypot strategies, accurate judgment of attack behavior, and security defense decisions.

[0089] Optionally, after obtaining the analysis results by analyzing the attack behavior characteristics of the interactive data, the method further includes: if the analysis results do not meet the preset update conditions, performing structured processing on the interactive data and analysis results to obtain structured intelligence information.

[0090] Structured processing refers to the process of organizing, decomposing, classifying, and formatting scattered raw interactive data and unstructured analysis results according to unified and standardized data formats, field definitions, and classification logic. Structured intelligence information refers to standardized network attack behavior intelligence data that, after being organized and processed, possesses standard fields, standardized formats, is storable and retrievalable, and can be subsequently analyzed and retrieved.

[0091] In one embodiment, when the analysis results do not meet the preset update conditions, the process of structuring the interactive data and analysis results to obtain structured intelligence information can be as follows: The system first verifies whether the analysis results of the current attack behavior meet the preset update conditions. If it is determined that the conditions for triggering the update of honeypot parameters and trapping strategies are not met, the configuration adjustment process will not be executed. According to the predefined standard data fields and standardized format, the original scattered interactive log data, analysis results of various attack characteristics and level determinations are decomposed, classified, filled with fields, and format standardized and encapsulated. Redundant and invalid information is eliminated, and the data is uniformly organized into structured intelligence information that is standardized, complete in fields, easy to store and retrieve, and easy to call for subsequent business operations. The structured intelligence information is then displayed.

[0092] In this embodiment, the original interactive data and attack analysis results can be standardized and structured to avoid the problems of scattered, messy, and unusable data. It can form structured intelligence information with unified format, standardized fields, and easy storage, archiving, retrieval, and subsequent in-depth mining. It not only completely retains the full feature data of this attack behavior, but also continuously accumulates a network attack sample library, providing sufficient, standardized, and high-quality basic data support for subsequent attack tracing, situation assessment, rule iteration, and security model training.

[0093] Figure 7 This is a schematic diagram of the structure of a dynamic update device for a network honeypot provided in an embodiment of this application, as shown below. Figure 7 As shown, it includes: Initialization module 21 is used to initialize the network honeypot; The attack behavior feature analysis module 22 is used to perform attack behavior feature analysis on the interaction data corresponding to the attack operation event when an attack operation event is detected, and obtain the analysis result. The environment configuration parameter determination module 23 is used to determine a first environment configuration parameter that matches the attack behavior characteristics in the analysis results and a second environment configuration parameter that matches the interactive data, when the analysis results meet the preset update conditions. The dynamic update module 24 is used to dynamically update the network honeypot obtained after initialization based on the first environment configuration parameters and the second environment configuration parameters.

[0094] This application embodiment initializes a network honeypot; upon detecting an attack event, it analyzes the interaction data corresponding to the attack event to obtain analysis results; if the analysis results meet preset update conditions, it determines a first environment configuration parameter matching the attack behavior characteristics in the analysis results and a second environment configuration parameter matching the interaction data; and it dynamically updates the initialized network honeypot based on the first and second environment configuration parameters. This approach enables the matching of appropriate environment configuration parameters to the network honeypot and dynamic updates based on real-time attack behavior analysis results, effectively solving the problems of traditional honeypots' static configuration, low simulation accuracy, and susceptibility to attackers. It significantly improves the honeypot's camouflage, deception, and anti-fingerprinting capabilities, extends its effective lifespan, and simultaneously achieves accurate perception and adaptive defense against attack behavior, enhancing the real-time performance and effectiveness of proactive network security protection.

[0095] In one possible embodiment, the attack behavior feature analysis module 22 is used for: A multi-dimensional feature vector is generated based on the operation sequence, instruction characteristics, access trajectory, and behavior frequency in the interaction data corresponding to the attack operation event. The multidimensional feature vector is matched with a preset attack behavior feature vector, and the attack behavior features are determined based on the matching results. The attack behavior features include attack type, attack intent, and attack stage, and the analysis results are obtained.

[0096] In one possible embodiment, the attack behavior feature analysis module 22 is used for: Calculate the feature similarity value between the multidimensional feature vector and the preset attack behavior feature vector. If the feature similarity value exceeds the preset similarity threshold, determine the attack type corresponding to the feature similarity value and the historical behavior data corresponding to the attack type. Based on historical timestamps, the operation data of each attacker in the historical behavior data are linked together to generate multiple operation chains; The multiple operation links are categorized and statistically analyzed. The operation link that appears most frequently in the statistical results is identified as the target operation link, and the attack intent corresponding to the target operation link is determined. The operation complexity is calculated based on the multidimensional feature vector to obtain a complexity value, and the attack stage corresponding to the complexity value is determined.

[0097] In one possible embodiment, the first environmental configuration parameters include simulation response mode, bait deployment strategy and environmental evolution mode, and the second environmental configuration parameters include environmental parameter adjustment range and trapping intensity level; Accordingly, the environment configuration parameter determination module 23 is used for: According to preset matching rules, the simulation response mode corresponding to the attack type, the decoy deployment strategy corresponding to the attack intent, and the environmental evolution mode corresponding to the attack stage are determined respectively. The attack density is determined based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data. The environmental parameter adjustment range and trapping intensity level corresponding to the attack density are determined according to the preset matching rules.

[0098] In one possible embodiment, the environment configuration parameter determination module 23 is used for: The frequency of unit operations in the interactive data is segmented and statistically analyzed according to a preset time window, and the operation surge state within a unit time is determined based on the segmented statistical results. The intervals between adjacent operations in the interactive data are compared with a preset range of operation time intervals, and the attack sequence continuity level is determined based on the processing results. The duration of continuous operation in the interaction data is compared with a preset stability threshold, and the stability parameter is determined based on the comparison result. The attack density level is determined based on the operational surge state, the attack timing continuity level, and the stability parameter.

[0099] In one possible embodiment, the environment configuration parameter determination module 23 is used for: The operation burst state, the attack timing continuity level, and the stability parameter are standardized and mapped to obtain a first quantization score, a second quantization score, and a third quantization score.

[0100] The attack density score is obtained by weighting and summing the first quantized score, the second quantized score, and the third quantized score according to preset weights. The attack density score is compared with the preset density grading threshold one by one, and the attack density level is determined based on the comparison results.

[0101] In one possible embodiment, a structuring processing module is further included, the structuring processing module being used for: If the analysis results do not meet the preset update conditions, the interactive data and the analysis results are processed in a structured manner to obtain structured intelligence information.

[0102] This application also provides an electronic device, which can integrate a dynamic update device for a network honeypot provided in this application. Figure 8 This is a schematic diagram of the structure of a dynamic update device for a network honeypot provided in an embodiment of this application. (Refer to...) Figure 8The dynamic update device for this network honeypot includes: an input device 33, an output device 34, a memory 32, and one or more processors 31; the memory 32 is used to store one or more programs; when one or more programs are executed by one or more processors 31, the one or more processors 31 implement the dynamic update method for the network honeypot as provided in the above embodiments. The input device 33, output device 34, memory 32, and processors 31 can be connected via a bus or other means. Figure 8 Taking the example of a connection between China and Israel via a bus.

[0103] The memory 32, as a computing device readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the dynamic update method of the network honeypot provided in any embodiment of this application. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the use of the device. Furthermore, the memory 32 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 32 may further include memory remotely located relative to the processor 31, and these remote memories can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0104] Input device 33 can be used to receive input digital or character information, and to generate key signal inputs related to user settings and function control of the device. Output device 34 may include display devices such as a display screen.

[0105] The processor 31 executes various functional applications and data processing of the device by running software programs, instructions and modules stored in the memory 32, thereby realizing the above-mentioned dynamic update method of the network honeypot.

[0106] The network honeypot dynamic update device, equipment, and computer provided above can be used to execute the network honeypot dynamic update method provided in any of the above embodiments, and have corresponding functions and beneficial effects.

[0107] This application embodiment also provides a storage medium for storing computer-executable instructions. When executed by a computer processor, the computer-executable instructions are used to execute the dynamic update method for a network honeypot provided in the above embodiment. The dynamic update method for a network honeypot includes: initializing the network honeypot; when an attack operation event is detected, performing attack behavior feature analysis on the interaction data corresponding to the attack operation event to obtain analysis results; when the analysis results meet preset update conditions, determining a first environment configuration parameter matching the attack behavior features in the analysis results and a second environment configuration parameter matching the interaction data, and dynamically updating the network honeypot obtained after initialization based on the first environment configuration parameter and the second environment configuration parameter.

[0108] Storage medium – any type of memory device or storage device. The term “storage medium” is intended to include: mounting media, such as CD-ROMs, floppy disks, or magnetic tape devices; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (e.g., hard disks or optical storage); registers or other similar types of memory elements, etc. Storage media may also include other types of memory or combinations thereof. Furthermore, storage media may reside in a first computer system in which a program is executed, or may reside in a different second computer system connected to the first computer system via a network (such as the Internet). The second computer system can provide program instructions to the first computer for execution. The term “storage medium” can include two or more storage media that may reside in different locations (e.g., in different computer systems connected via a network). Storage media may store program instructions (e.g., specifically implemented as a computer program) executable by one or more processors.

[0109] Of course, the computer-executable instructions provided in the embodiments of this application are not limited to the dynamic update method of the network honeypot as described above, but can also perform related operations in the dynamic update method of the network honeypot provided in any embodiment of this application.

[0110] The network honeypot dynamic update apparatus, device, and storage medium provided in the above embodiments can execute the network honeypot dynamic update method provided in any embodiment of this application. For technical details not described in detail in the above embodiments, please refer to the network honeypot dynamic update method provided in any embodiment of this application.

[0111] The above description is merely a preferred embodiment and the technical principles employed in this application. This application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions that can be made by those skilled in the art will not depart from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of this application, the scope of which is determined by the scope of the claims.

Claims

1. A method for dynamically updating a network honeypot, characterized in that, include: Initialize the network honeypot; Upon detecting an attack operation event, the attack behavior characteristics of the interaction data corresponding to the attack operation event are analyzed to obtain the analysis results. If the analysis results meet the preset update conditions, a first environment configuration parameter matching the attack behavior characteristics in the analysis results and a second environment configuration parameter matching the interaction data are determined, and the network honeypot obtained after initialization is dynamically updated based on the first environment configuration parameter and the second environment configuration parameter.

2. The dynamic update method for network honeypots according to claim 1, characterized in that, The analysis results obtained by performing attack behavior feature analysis on the interaction data corresponding to the attack operation event include: A multi-dimensional feature vector is generated based on the operation sequence, instruction characteristics, access trajectory, and behavior frequency in the interaction data corresponding to the attack operation event. The multidimensional feature vector is matched with a preset attack behavior feature vector, and the attack behavior features are determined based on the matching results. The attack behavior features include attack type, attack intent, and attack stage, and the analysis results are obtained.

3. The dynamic update method for network honeypots according to claim 2, characterized in that, The step of matching the multidimensional feature vector with a preset attack behavior feature vector and determining the attack behavior features based on the matching result includes: Calculate the feature similarity value between the multidimensional feature vector and the preset attack behavior feature vector. If the feature similarity value exceeds the preset similarity threshold, determine the attack type corresponding to the feature similarity value and the historical behavior data corresponding to the attack type. Based on historical timestamps, the operation data of each attacker in the historical behavior data are linked together to generate multiple operation chains; The multiple operation links are categorized and statistically analyzed. The operation link that appears most frequently in the statistical results is identified as the target operation link, and the attack intent corresponding to the target operation link is determined. The operation complexity is calculated based on the multidimensional feature vector to obtain a complexity value, and the attack stage corresponding to the complexity value is determined.

4. The method for dynamically updating a network honeypot according to claim 2, characterized in that, The first environmental configuration parameters include the simulation response mode, bait deployment strategy, and environmental evolution mode; the second environmental configuration parameters include the environmental parameter adjustment range and the trapping intensity level. Accordingly, determining the first environment configuration parameter that matches the attack behavior characteristics in the analysis results, and the second environment configuration parameter that matches the interaction data, includes: According to preset matching rules, the simulation response mode corresponding to the attack type, the decoy deployment strategy corresponding to the attack intent, and the environmental evolution mode corresponding to the attack stage are determined respectively. The attack density is determined based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data. The environmental parameter adjustment range and trapping intensity level corresponding to the attack density are determined according to the preset matching rules.

5. The method for dynamically updating a network honeypot according to claim 4, characterized in that, The step of determining the attack density based on the unit operation frequency, adjacent operation interval, and continuous operation duration in the interaction data includes: The frequency of unit operations in the interactive data is segmented and statistically analyzed according to a preset time window, and the operation surge state is determined based on the segmented statistical results within a unit time period. The intervals between adjacent operations in the interactive data are compared with a preset range of operation time intervals, and the attack sequence continuity level is determined based on the processing results. The duration of continuous operation in the interaction data is compared with a preset stability threshold, and the stability parameter is determined based on the comparison result. The attack density level is determined based on the operational surge state, the attack timing continuity level, and the stability parameter.

6. The method for dynamically updating a network honeypot according to claim 5, characterized in that, The step of determining the attack density level based on the operational surge state, the attack timing continuity level, and the stability parameter includes: The operation burst state, the attack timing continuity level, and the stability parameter are standardized and mapped to obtain a first quantization score, a second quantization score, and a third quantization score. The attack density score is obtained by weighting and summing the first quantized score, the second quantized score, and the third quantized score according to preset weights. The attack density score is compared with the preset density grading threshold one by one, and the attack density level is determined based on the comparison results.

7. The method for dynamically updating a network honeypot according to claim 5, characterized in that, After obtaining the analysis results by performing attack behavior feature analysis on the interactive data, the method further includes: If the analysis results do not meet the preset update conditions, the interactive data and the analysis results are processed in a structured manner to obtain structured intelligence information.

8. A dynamic update device for a network honeypot, characterized in that, include: The initialization module is used to initialize the network honeypot; The attack behavior feature analysis module is used to perform attack behavior feature analysis on the interaction data corresponding to the attack operation event when an attack operation event is detected, and obtain the analysis results. The environment configuration parameter determination module is used to determine, when the analysis results meet preset update conditions, a first environment configuration parameter that matches the attack behavior characteristics in the analysis results and a second environment configuration parameter that matches the interactive data. The dynamic update module is used to dynamically update the network honeypot obtained after initialization based on the first environment configuration parameters and the second environment configuration parameters.

9. An electronic device, characterized in that, The device includes: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the dynamic update method for the network honeypot as described in any one of claims 1-7.

10. A storage medium for storing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the dynamic update method of the network honeypot as described in any one of claims 1-7.

Images